Hello Vercel Team,
I'm based in Pakistan and evaluating Vercel Sandbox Hobby for a small, personal, non-commercial security research project.
The proposed workload involves analyzing my own harmless JavaScript fixture using REA 6.4.0 inside a temporary Linux Sandbox. No third-party targets, malware, or commercial workloads are involved.
Before creating any Sandbox, I'd appreciate clarification on three points:
- Free-tier eligibility
- Can Pakistan residents use Sandbox Hobby without adding a payment card?
- Does the free tier support a 2-vCPU, 4-GB Sandbox?
- Does usage stop without charges when the free allowance is exhausted?
- Is this personal research workload permitted?
- Security and isolation
- With
deny-allnetworking, no exposed ports, no shared drives, and no guest credentials, which management channels remain accessible from inside the Sandbox? - Can guest processes modify firewall policies, session expiry, or management settings?
- What are the enforced limits and retention periods for stdout, stderr, and Sandbox logs?
- Security updates
- Have the issues disclosed in the October 14, 2026 Sandbox security report been mitigated across current Hobby infrastructure, including kernel and recycled-storage issues?
- Is there public documentation confirming the current mitigation status?
We haven't created or executed a Sandbox yet. We are requesting clarification before proceeding with testing.
Thank you for your assistance.